medium4.2
CVE-2024-32963
Navidrome Parameter Tampering vulnerability
Impact
### Summary Parameter tampering is a vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. ### Details The attacker is able to change the parameter values in the body and successfully impersonate another user. In this case, the attacker created a playlist, added song, posted arbitrary comment, set the playlist to be public, and put the admin as the owner of the playlist. ### Impact Each known user is impacted. An attacker can obtain the ownerId from shared playlist information, meaning every user who has shared a playlist is also impacted, as they can be impersonated.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/navidrome/navidrome | < 0.52.0 | 0.52.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Navidrome | Navidrome | before 0.52.0 |